IBM WebSphere V5.0 Security - CGISecurity

4. You must complete the following fields to enable LDAP communication overSSL:– SSL status: select SSL On or SSL Only if you wish to prevent non-SSLLDAP connections.– Authentication method: select Server Authentication. You may opt toselect Server and Client Authentication, in which case you need toensure that the public certificate key associated with any authenticatingclient is resident in your (LDAP) certificate key database.– Secure port: select 636 which is the Internet standard for secure LDAPcommunication. You may choose any port that is not in use. On Unix, onlythe root has access to the ports below 1024 by default.– Key database path and file name: specify the fully qualified file name ofthe CMS key database previously created. In our example, this is set toC:/LDAP/config/SecureWayLDAP.kdb . SecureWay does not support theJava Key Store (JKS) type certificate key database.– Key label: since a key database can contain multiple certificates, specifythe label name of the certificate used for authenticating the LDAPDirectory Server. In our example this is set to LDAPSSL.– Key password: specify the key database password if you did notgenerate a password stash file when creating the certificate key databaseoriginally. This password will be used by SecureWay to gain access to thecertificate database.5. Click the Update button when you have completed all of the above fields.6. For the changes to be included into the runtime, you must stop and restart theLDAP Directory Server. Once restarted, you can check the status of theDirectory by expanding the Current State and Server Status menus. If theDirectory fails to start, check the Error logs. Unix users can also check thatthe Directory is listening for incoming SSL LDAP connections by using thenetstat -a command and “grepping” for port 636.If you are concerned with the level of SSL support offered by the SecureWayLDAP Directory Server, you can choose to restrict the permitted encryptionalgorithms. For example, you may decide that (40-bit) encryption is inadequatefor your SSL implementation. In this case, the (40-bit) encryption method can bedeselected, as shown in Figure 10-60.Chapter 10. Administering WebSphere security 331